Link to home
Start Free TrialLog in
Avatar of Joemt
Joemt

asked on

SBS2011 Shut down unexpectedly - Error log: Source User32, event ID 1074 "No Title for this reason can be found"

SBS2011 initiated a shutdown unexpectedly.  I trying to identify why the server suddenly shutdown.

Found in Event Log:

Log Name: System - Source = USER32, Event ID = 1074

The process c:\windows\system32\winlogin.exe (SBSERVER) has initiated the power off of computer SBSERVer on behalf of user NT AUTHORITY\SYSTEM for the following reason" No title for this reason could be found
Reason code 0x500ff
Shutdown Type: power off


Prior to this I found an event log for:

System /source = WAS/Event Id= 5117

A worker process with a process id of "21708" serving application pool "WsusPool" has requested a recycle because it has reached it's private memory limit

Could the WAS issue caused the shutdown?
Avatar of Imtiaz Hasham
Imtiaz Hasham
Flag of United Kingdom of Great Britain and Northern Ireland image

Windows Updates caused the restart.

Check the hardware logs to see why the shutdown wasn't graceful - I have had this issue before on a SBS - turns out, the hardware wasn't allowing graceful shutdown.
Avatar of Joemt
Joemt

ASKER

The Server again went down...I found this in the system log. Any ideas?

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          6/3/2014 5:05:28 PM
Event ID:      1058
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      SBSERVER.****.local
Description:
The processing of Group Policy failed. Windows attempted to read the file \\****.local\SysVol\****.local\Policies\{65AD712B-7661-4EC7-B609-8C3AC7770B7C}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
    <EventID>1058</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-06-03T23:05:28.606506600Z" />
    <EventRecordID>1436497</EventRecordID>
    <Correlation ActivityID="{9B6FA122-6787-4F81-AD46-D434970D2507}" />
    <Execution ProcessID="1004" ThreadID="7900" />
    <Channel>System</Channel>
    <Computer>SBSERVER.******.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">4</Data>
    <Data Name="SupportInfo2">816</Data>
    <Data Name="ProcessingMode">0</Data>
    <Data Name="ProcessingTimeInMilliseconds">17534</Data>
    <Data Name="ErrorCode">64</Data>
    <Data Name="ErrorDescription">The specified network name is no longer available. </Data>
    <Data Name="DCName">SBSERVER.*****.local</Data>
    <Data Name="GPOCNName">cn={65AD712B-7661-4EC7-B609-8C3AC7770B7C},cn=policies,cn=system,DC=*****,DC=local</Data>
    <Data Name="FilePath">\\*****.local\SysVol\beallaw.local\Policies\{65AD712B-7661-4EC7-B609-8C3AC7770B7C}\gpt.ini</Data>
  </EventData>
</Event>
ASKER CERTIFIED SOLUTION
Avatar of Joemt
Joemt

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Joemt

ASKER

finally ended up with a error indicator on the server it self - corrected with new powers upply
what is the answer